CVE-2026-5271 — Possible to hijack modules in current working directory
pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pym…
Published: 2026-04-01 · CVSS: 5.6 · CVSS 4.0
pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7